This vulnerability (CVE-2025-13124) in ApplyLogic allows an attacker with limited privileges to bypass authorization controls by manipulating a user-controlled key that is used as a trusted identifier. This flaw falls under CWE-639, which concerns authorization bypass through user-controlled keys. The vulnerability affects versions of ApplyLogic up to 01.12.2025. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, with low confidentiality impact, high integrity impact, and low availability impact.

Successful exploitation could allow an attacker with some privileges to bypass authorization mechanisms, potentially leading to unauthorized modification of data (high integrity impact) and limited confidentiality loss. Availability impact is low. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor vendor communications for updates and apply any official patches once available. Until then, restrict access to trusted users and review authorization configurations to minimize risk.